# Keycloak password reset flaw let anyone skip the email token and take over any account

Source: https://startwithidentity.com/blog/2026-08-24-keycloak-reset-credentials-flow-account-takeover/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

[Keycloak](https://startwithidentity.com/vendors/open-source/keycloak/) patched [CVE-2026-18963](https://startwithidentity.com/cves/cve-2026-18963/) on August 19, 2026, a CVSS 9.1 flaw that allowed unauthenticated account takeover through the password reset endpoint. The reset-credentials authentication flow validated its own state improperly: a crafted request advanced the authentication session directly to the update-password execution, skipping the send-reset-email step that issues and checks the verification token. An attacker needs a username or email address and nothing else. Administrative accounts are in scope. Fixed in upstream 26.7.2 and in Red Hat build of Keycloak 26.4.15-1 and 26.6.6-1. Reported by James Paremain. No public exploit and no observed exploitation as of publication.

## Why it matters

Account recovery is an authentication path that gets designed as a support feature. Every control at the front door, [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) included, is worth nothing against a reset flow that hands over the password on request, and this is the second Keycloak flaw in our catalog to turn a flow-state assumption into a takeover after [CVE-2023-6787](https://startwithidentity.com/cves/cve-2023-6787/). Because Keycloak is the [identity provider](https://startwithidentity.com/glossary/identity-provider/) rather than an app behind one, the blast radius is every service that trusts it for [SSO](https://startwithidentity.com/glossary/sso/). Upgrade, then hunt the admin event log for `UPDATE_PASSWORD` events with no matching `SEND_RESET_PASSWORD` for the same user and session, and require [step-up authentication](https://startwithidentity.com/glossary/step-up-auth/) on the admin console so a password alone does not administer the realm.

Source: [The Hacker News](https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html)